discordrat | 9150a13870201639aa50f7aeeff0f64bedc72e6e37a878465135221f8c282676

General

Target
9150a13870201639aa50f7aeeff0f64bedc72e6e37a878465135221f8c282676_NeikiAnalytics.exe
Size 6.3MB
Sample240628-llsrjsvgpk
SHA256 9150a13870201639aa50f7aeeff0f64bedc72e6e37a878465135221f8c282676
MD5 242d3543e74bb90d18f720ca102467b0
SHA1 14d731832a01f57a01eb824773b2431fe1703ded
SHA512 e048e1e63356546268407c22f39661f08eb2a839845783ca248703d56b0b3d9ab39a5538e1c68ad4d8258cf13ce16fa7fbe423d15e18addc19cd8c97785dc069
SSDEEP 98304:zf+RWwamZZcJCZo/g+iE30txIOhDKszmwdM:zGRWHCZo/gsEHIPSe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIyMTE4NjI0NzgwOTE3MTUyNw.GSCOTR.Eh-rIiDlHbTdHlbNBtQBvL4mNr_1CZSJAFMdUU
server_id
1221187390354227391

Targets

- Target
  9150a13870201639aa50f7aeeff0f64bedc72e6e37a878465135221f8c282676_NeikiAnalytics.exe
- Size 6.3MB
- SHA256 9150a13870201639aa50f7aeeff0f64bedc72e6e37a878465135221f8c282676
- MD5 242d3543e74bb90d18f720ca102467b0
- SHA1 14d731832a01f57a01eb824773b2431fe1703ded
- SHA512 e048e1e63356546268407c22f39661f08eb2a839845783ca248703d56b0b3d9ab39a5538e1c68ad4d8258cf13ce16fa7fbe423d15e18addc19cd8c97785dc069
- SSDEEP 98304:zf+RWwamZZcJCZo/g+iE30txIOhDKszmwdM:zGRWHCZo/gsEHIPSe
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discordrat evasion persistence rat rootkit stealer themida trojan
- Discord RAT
  A RAT written in C# using Discord as a C2.
  stealer rootkit rat persistence discordrat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Discord RAT

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2